WordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Media Library Downloader versions = 1.3.1...

WordPress WP-reCAPTCHA-bp plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin WP-reCAPTCHA-bp versions = 4.1...

WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin All in One Time Clock Lite versions 1.3.326...

WordPress External Markdown plugin <= 0.0.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin External Markdown versions = 0.0.1...

WordPress WP Filter Post Category plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin WP Filter Post Category versions = 2.1.4...

WordPress Verification SMS with TargetSMS plugin <= 1.5 - Unauthenticated Limited Remote Code Execution vulnerability

Unauthenticated Limited Remote Code Execution vulnerability discovered by Cheng Liu in WordPress Plugin Verification SMS with TargetSMS versions = 1.5...

WordPress Memberpress plugin <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin MemberPress versions = 1.11.37...

WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Frontend Dashboard versions = 2.2.5...

WordPress GutenKit plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Yusuf in WordPress Plugin GutenKit versions = 2.2.2...

WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin HTML Forms versions = 1.5.2...

WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Download Alt Text AI versions = 1.9.93...

WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Sky Addons for Elementor versions = 3.0.1...

CVE-2024-41446

A stored cross-site scripting XSS vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to PHP Object Injection

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39348 Patch priority High CVSS severity High 9.8 Developer EPC PSID c0bb2279949a Credits Ananda Dhakal Patchstack Required privilege...

@quasar/quasar-app-extension-qmarkdown (>=1.0.0 <=1.4.4), @sourcedigital/jsonforms-vue2-quasar-v1 (>=0.1.3 <=0.1.5) +8 more potentially affected by CVE-2025-43954 via @quasar/quasar-ui-qmarkdown (=1.4.4)

@quasar/quasar-ui-qmarkdown NPM version =1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on @quasar/quasar-ui-qmarkdown and may be impacted: - @quasar/quasar-app-extension-qmarkdown =1.0.0, =0.1.3, =0.0.1, =0.10.7, =0.0.1, =0.0.3, =0.0.1, =0.10.2,...

WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Booking and Rental Manager versions = 2.3.6...

Denkovi DAEnetIP4 METO 安全漏洞

Denkovi DAEnetIP4 METO is a multifunctional 10/100 Mb Ethernet device IP controller from Denkovi for management and control. A security vulnerability exists in Denkovi DAEnetIP4 METO version 1.25, which stems from improper session management in the /loginok.htm endpoint, and could lead to a sessi...

WordPress Avatar plugin <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by theviper17y in WordPress Plugin Avatar versions = 0.1.4...

WordPress Ultimate Dashboard plugin < 3.8.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Ultimate Dashboard versions 3.8.6...

WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress WordPress Video Robot - The Ultimate Video Importer plugin = 1.20.0 - Reflected Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin WordPress Video Robot - The Ultimate Video Importer versions = 1.20.0...